Broadband security: The power of Secure Boot against persistent malware

Welcome to the world of broadband security, where the stakes are high, and the threats are ever evolving. In this blog, we delve into the powerful functionality of Secure Boot and how Internet Service Providers (ISPs) can leverage it to combat the growing menace of persistent malware.

Why persistent? Well, because it overstays its welcome even after you reboot your device. Persistent malware cleverly installs itself in the flash memory (i.e., the local storage), ensuring that it reactivates every time you restart your device.

Buckle up and join us as we explore the implications, potential damage and the significance of Secure Boot as a crucial defense mechanism for broadband networks.

The threat of persistent malware

The chaos that ensues when persistent malware infiltrates the broadband network is enormous. In 2016, Deutsche Telekom (DT) experienced a massive disruption when a variant of the notorious Mirai malware attacked three of their router models, rendering approximately 900,000 internet subscribers offline.

Fortunately, DT swiftly responded by deploying firmware updates, resolving the vulnerability. However, had the malware persisted and disabled remote management updates, the consequences could have been catastrophic. This is the ‘perfect storm’ scenario that keeps ISPs awake at night, as recovering from such an attack entails significant costs, customer dissatisfaction and a potential loss of control.

And the Distributed Denial of Service (DDoS) attacks are only getting bigger and more powerful every day. In February 2023, web infrastructure company Cloudflare revealed its successful defense against a groundbreaking DDoS attack . This ‘hyper-volumetric’ assault peaked at an astounding 71 million requests per second, setting a new record in the realm of DDoS attacks.

Utilizing secure boot for robust recoverability

To protect Customer Premises Equipment (CPE) devices from persistent malware, ISPs can harness the power of Secure Boot. This functionality works much like a lock on your front door, ensuring unauthorized changes are prevented and the CPE chipset remains secure. When the router initiates, the chipset carefully examines any new software installed in the flash memory, executing it only if it’s authorized and signed with a recognizable key.

Thanks to the verification key stored in one time programmable memory during manufacturing, the chipset cannot be swayed by malicious software attempting to use an alternative, malware-controlled key. With Secure Boot – which relies on a hardware root-of-trust – ISPs can rest assured that only authorized and tamper-proof software will operate on the router. This robust defense mechanism greatly reduces the risk of a rogue fleet of routers breaking free from the ISP’s control.

However, this defense mechanism is not completely bulletproof …

Secure Boot: A piece of the puzzle, but not the whole solution

There’s still a possibility of rogue software infiltrating devices through application software vulnerabilities. However, the crucial difference is that this rogue software won’t be able to establish persistent installations. As a result, the infection can’t fully take hold, ensuring that ISPs won’t be locked out of the CPE, even in the event of a ‘perfect storm’ attack. Secure Boot plays a vital role in mitigating the impact of such attacks and providing a higher level of control and recoverability.

Differences in Secure Boot solutions

Secure Boot is a simple concept widely acknowledged in the Internet of Things (IoT) security guidelines developed across industries; for example, in ETSI’s world-first standard to secure consumer IoT devices which was also extended to home gateways. However, not all Secure Boot solutions are created equal.

ISPs must ensure that their signing keys are securely stored, backed up, managed, used, accessed and (possibly) revoked throughout the routers’ lifetime. Additionally, consistent device configuration and software implementation across all their CPE suppliers are crucial. Secure Boot cannot just be simply downloaded with a software update. It needs to be designed and configured properly by the manufacturer, who also needs to take care of correctly fusing it with its trust anchor.

While many CPE vendors offer Secure Boot, ISPs should seek comprehensive protection that encompasses factors like access to code signing keys, infrastructure readiness, compliance programs such as ISO 27001:2013 and the expertise of seasoned cybersecurity companies with extensive embedded security experience.

Communication between CPE devices and ISP’s backend

A data-driven architecture is used to distribute new services to subscribers combining cloud services, mobile apps and intelligent CPE . The CPE telemetry transmits data gathered from the home back to the service provider.

The data is stored and analyzed by the ISP’s backend infrastructure, orchestrating the CPE to provide the relevant services based on its findings.

To put it another way, a modern CPE device talks with and is strongly tied to the ISP’s backend, where, the backend regards the CPE as if it were a component of the ISP’s own infrastructure.

But what happens when trust is misplaced and adversaries impersonate CPEs ? Find out more in our e-book “Broadband CPE: An ISP’s Biggest Asset or Its Weakest Link? ” where we dive deeper into real-life CPE security case studies and shed light on effective strategies to spot spoofed devices.

How can you protect your broadband CPE?

Protecting broadband networks from persistent malware is critical for ISPs. While Secure Boot serves as a powerful mechanism, it is important to implement comprehensive security measures and select the right solutions to ensure maximum protection . Let’s fortify our networks and safeguard our digital future.